PATENT 

REMARKS 

Claims 1, 2, 4-10, 12-17 and 19-30 are pending in the application. 
Claims 1, 2, 4-10, 12-17 and 19-30 have been rejected. 

Re jection o f Claims under 35 U.S.C. $103 

Claims 1, 2, 4-10, 12-17 and 19-30 stand rejected under 35 U.S.C. § 103(a) as being 
rendered obvious by U.S. Patent No. 6,570,875, issued to Hegde ("Hegde") in view of U.S. 
Patent No. 5,884,080, issued to Blandy ("Blandy"), and, for some claims, one or more additional 
references. Applicants respectfully traverse these rejections. 

In order for a claim to be rendered invalid under 35 U.S.C. § 103, the subject matter of 
the claim as a whole would have to be obvious to a person of ordinary skill in the art at the time 
the invention was made. See 35 U.S.C. § 103(a). This requires: (1) the reference(s) must teach 
or suggest all of the claim limitations; (2) there must be some teaching, suggestion or motivation 
to combine references either in the references themselves or in the knowledge of the art; and (3) 
there must be a reasonable expectation of success. See MPEP 2143; MPEP 2143.03; In re 
Rouffet, 149 F.3d 1350, 1355-56 (Fed. Cir. 1998). The burden is on the examiner to support a 
case of obviousness, including whether the prior art references teach or suggest all of the claim 
limitations. See MPEP 706.02(j). Applicants respectfully submit that the arguments presented 
by the Examiner in the present Final Office action dated November 1, 2005 ("Final Office 
Action") fail to establish all of these requisite criteria for rendering the pending claims of the 
application unpatentable. In light of the discussion below, Applicants respectfully request that 
the Examiner withdraw the rejections and provide a notice of allowability for all pending claims. 
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Independent Claims 1, 9, 16 and 23: 

Independent Claims 1, 9, 16 and 23 all stand rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Hegde in view of Blandy. Applicants respectfully traverse these rejections. 

"Determining whether to Process the Group of Information for Network Traffic Data 
Collection " (Hegde) 

Each of the independent claims contained a limitation substantially of the form 
"determining whether to process the group of information for network traffic data collection" 
See, e.g., Claim 1. Network traffic data can include source, destination, protocol, type of service, 
number of packets in a traffic flow, total number of bytes in a traffic flow, first and last time 
stamps of packets switched as part of a flow, etc. See Application, pp. 10-11. Network traffic 
data can be used for purposes such as network analysis and planning, network management, 
accounting, billing, and data mining. Network traffic data further enables network managers to 
monitor network traffic, determine bandwidth requirements, insure quality of service 
compliance, and fine-tune network performance. See Application, p. 1 1. While the Final Office 
action suggests that various sections of Hegde provide disclosure of the referenced claim 
limitation, Applicants respectfully submit, and will establish below, that none of the cited 
sections of Hegde provide disclosure of determining whether to process a group of information 
for network traffic data collection as that term is defined by the present application. 

The Final Office action lists the following sections as providing disclosure of determining 
whether to process a group of information: 

(1) Fig. 2, IP packet: Applicants respectfully submit that the referenced IP packet is not 

illustrated in Fig. 2. Even were an IP packet illustrated, Applicants 
submit that such an illustration would not disclose the claim 
limitation. 

(2) Hegde 4:34-53: The cited section purports to describe a multiprotocol switch that is 

disclosed to have the ability to forward packets among and 
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between local nodes and external networks that are attached to the 
multiprotocol switch. The cited section also purports to describe 
parts of Fig. 2, including a flow table 70 disclosed to be a mapped 
memory space accessible to switch module 60 and CPU 80. 
Applicants respectfully submit that no language within the cited 
section of Hegde discloses the claim limitation. 

(3) Hegde 5:30-50: The cited section purports to describe, inter alia, a "routing 

domain" defined as multiple ports belonging to a same IP or IPX 
network or having the same IP or IPX address and subnet mask. 
The cited section also states that "switch module 60 continually 
monitors each of the ports for incoming traffic." Hegde 5: 40-41. 
The cited section further discloses that whenever a data packet 
arrives, the packet header is checked for information identifying a 
data flow to which the packet belongs. Hegde 5: 41-43. 
Applicants respectfully submit that the cited section provides no 
disclosure of determining whether to process a group of 
information. The cited section merely links a packet with a data 
flow and extracts the linking information from each packet 
received by the disclosed device. 

(4) Fig.7 (S30 & S32): Step 30 illustrated in Fig. 7 is a conditional determining whether 

a packet is of an IP/IPX or ARP/RARP type. Step 32 illustrates 
processing a packet at Layer 3+ (L3) if the conditional in Step 30 
is met. If the conditional in Step 30 is not met, then the packet is 
illustrated as being processed at Layer 2 (L2) in Step 26. 
Applicants respectfully submit that there is no disclosure in Fig. 7 
of determining whether to process a group of information or not. 
Instead Fig. 7 selects a processing type based upon whether a 
packet should be processed at L2 or L3. Each packet received by 
Hegde is so processed, either at L2 or L3. 

(5) Hegde 8:25-9:39: This cited section purports to describe the algorithm illustrated in 

the flow chart of Fig. 7. The cited section contains the following 
disclosure: 

o The switch engine continually monitors for data packets (Hegde 
8:18-19) and each packet is processed according to Fig. 7 (Hegde 
8:21-23); 

o IGMP processing occurs to keep multicast tables up-to-date 
(Hegde 8:23-31); 

o Fig. 7 illustrates steps in packet processing and switching (Hegde 
8:32-34); 

o For S20, if a packet is multicast, then packet information is 

forwarded to a CPU to update VLAN information per S22 (Hegde 
8:35-42); 
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o For S24, a check is made to see if L3 processing is enabled, and if 
not then all packets are processed at layer 2 per S26 (Hegde 8:43- 
49); 

o A description is provided as to how protocols used by hosts can be 
determined by looking at an Ethernet packet header (Hegde 8:50- 
64), identifying layer 4 protocols in layer 3 headers (Hegde 8:65- 
9:9), identifying IPX protocols (Hegde 9:10-20), and thereby 
identifying an associated flow of a packet by examining source and 
destination or socket information in an appropriate L2 or L3 packet 
header (Hegde 9:21-26); 

o For S28, determining a packet protocol type (Hegde 9:30-31); for 
S30, if a packet is not IP/IPX or ARP/RARP, then processing the 
packet as an L2 packet (Hegde 9:34-37); and 

o For S32 processing appropriate packets in accord with L3+ 
protocols (Hegde 9:37-40). 

Applicants respectfully submit that this cited section of Hegde 
provides no disclosure of determining whether to process a group 
of information as claimed. Instead, the disclosed processing 
relates to whether to perform L2, L3 or multicast VLAN updating. 
Applicants further submit that the entirety of the cited text relates 
to determining a type of protocol for each data packet and basing a 
L2 or L3 processing decision on that. No determination of whether 
or not to process a particular packet is made, since each and every 
packet received is processed in some way. Further, the disclosure 
does not relate to determining whether to process a group of 
information for network traffic data collection as that term is 
defined within the present application. 

The Final Office Action further lists the following sections of Hegde as providing disclosure of 

determining whether to process a group of information for network traffic data collection: 

(1) Fig.8 (S42 & S44): Step S42 of Fig. 8 is a purported illustration of checking a flow 
table for source and destination entries. This step is disclosed as 
part of the L3 processing from Step S32 in Fig. 7, which is 
performed after determining the L3 source and destination. Hegde 
9:44-49. Based upon the checking of the flow table, Step S44 
contains a conditional that provides for forwarding the packet 
according to flow table instructions if there is a flow entry already 
in the flow table (Hegde 9:50-51), and resolving the flow to 
provide forwarding information and links if there are not entries 
for the source and destination in the flow table (Hegde 9:56- 
10:23). In neither case is a determination made as to whether to 
process a group of information for network data collection, since 
for each packet the packet is either forwarded according to present 
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information in a flow table or new flow table information is 
generated. 

(2) Hegde 2:65-3:9: This section of the Summary of the Invention relates to 

determination of associated flow from examination of an incoming 
packet (Hegde 2:65-67), and a flow table is examined to determine 
whether it contains forwarding information associated with the 
packets flow (Hegde 2:67-3:2), If the flow table does not contain a 
matching flow entry to the packet, then the CPU updates the flow 
table with the new forwarding information that can then be applied 
to all future packets of the same flow (Hegde 3 :2-6). Again, the 
cited section provides no disclosure of determining whether to 
process a group of information for network traffic data collection. 
Rather, the section discloses updating a router flow table. 

Updating a flow table is distinct from network traffic data 
collection. Claim 4 of the present application illustrates this 
distinction by providing for determining routing and forwarding 
information for the group of information as a separately claimed 
task. In addition, even Claim 1 distinguishes between 
"determining" and "forwarding," with a separate and distinct 
forwarding limitation from the determining limitation. 

(3) Hegde 9:40-55: This section purports to discuss of Fig. 8. Fig. 8 is stated to 

illustrate switch engine processing of L3 packets (Hegde 9:40-42). 
The source and destination are extracted from an L3 header (Hegde 
9:44-49). "Switch engine 100 then checks to see whether entries 
exist in the flow table for both ends of the flow (step S42). If 
entries exist for both ends of the flow (determined in step S44), the 
packet is forwarded at wire speed in accordance with any filters, 
mirrors, priorities or VLANs established in the flow table entry 
(Step S46) ." Hegde 9:50-55. Applicants submit that this provides 
disclosure for determining whether a flow table contains 
instructions for forwarding a received packet in an indicated flow. 
Applicants submit that no disclosure is provided for determining 
whether to process a group of information for network traffic data 
collection. 



For the above reasons, Applicants respectfully submit that none of the cited sections of Hegde 
provide disclosure for the claim limitation of "determining whether to process the group of 
information for network traffic data collection." As stated above, each packet received by the 
Hegde router must be examined and processed either as an L2 or L3 packet. Therefore, there is 
no determination in Hegde of whether or not to process a packet. Further, none of the cited 
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disclosure provides for network traffic data collection. Instead, Hegde either performs an L2 or 
L3 check or updates a flow table entry, which is distinct from network traffic data collection. 

"Selecting the Group of Information Based on an Examination of Traffic Attribute Data" 
(HesM 

The Final Office Action further cites to Hegde for disclosing the claim limitation 
"determining whether to process the group of information for network traffic data collection 
wherein said determining is performed according to a sampling algorithm that is selected from 
one of . . . selecting the group of information based on an examination of traffic attribute data in 
the group of Information." See, e.g., Claim 1. As an initial matter, Applicants submit that in 
light of the above discussion, Hegde does not disclose "determining whether to process the group 
of information for network traffic data collection," and therefore cannot disclose this additional 
claim limitation. Applicants further respond to the citations provided in the Final Office Action: 

(1) Fig. 8 (S48 & S54): Step S48 of Fig. 8 is a conditional entitled "Only Destination 

Unresolved?" Hegde states "if only the destination end of the flow 
was unresolved (determined in step S48), a flow table entry exists 
for the source end of the flow, containing a broadcast enable entry 
for the source. Accordingly, switch engine 100 forwards the 
packet on the port(s) indicated by the broadcast enable entry 
associated with the source (step S56)." (Hegde 9:59-65). 
Similarly, Step S54 in Fig. 8 is a conditional entitled "Only Source 
Unresolved?" Hegde suggests that such packets are forwarded to 
the CPU to create a flow table entry (Hegde 9:66-10:1 1). 
Applicants respectfully submit that these conditionals for Fig. 8 
determine an action to take place based on whether information in 
a packet header is present in a flow table. These steps do not 
disclose selecting a group of information based on an examination 
of traffic attribute data in the group of information as an aid to 
determining whether to process the group of information for 
network traffic data collection. 

(2) Hegde 9:40-55: This section of text in Hegde is discussed in the above section. For 

the reasons cited above, Applicants respectfully submit that this 
section does not disclose the cited claim limitation. 

(3) Hegde 10:35-42: This text purports to describe Fig. 9, which is indicated to be CPU 

processing of unresolved L3 packets. Fig. 9 discusses creating a 
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flow table entry for unresolved sources which includes filters, 
mirrors and priorities associated with such a source using a flow 
table from Fig. 10 (Hegde 10:35-42). Applicants respectfully 
submit that this section does not provide for the claimed selecting a 
group of information based on an examination of traffic attribute 
data in the group of information as an aid to determining whether 
to process the group of information for network traffic data 
collection. 

In light of the above discussion, Applicants respectfully submit that the cited sections of Hegde 
do not disclose the referenced limitation of independent Claims 1, 19, 16, and 26. 

Selecting Based on Burst Sample Algorithm (Blandv) 

The Final Office Action suggests that Blandy teaches the claim limitation "determining 
whether to process the group of information for network traffic data collection, wherein said 
determining is performed according to a sampling algorithm that is selected from one of ... a 
burst sampling algorithm, and selecting the group of information based on an examination of 
traffic attribute data in the group of information." See Claim 1. For this proposition, the Final 
Office Action cites to the following sections: 

(1) Fig. 2: Fig. 2 is a flow chart presented to illustrate how performance 

monitoring is enabled or initiated according to Blandy (Blandy 
3:36-37 and 4:27-5:27). No determination of whether to process a 
group of information is made in any of the disclosure provided for 
Fig. 2. 

(2) Fig. 3: Fig. 3 is a flow chart presented to illustrate a method of handling 

external interrupts (Blandy 3:38-39 and 5:28-6:24). The disclosure 
states that if a performance monitor interrupt is received, then a 
burst mask is read to determine how many instructions to monitor 
and such information is propagated to all processors in a 
symmetric multiprocessing environment. The disclosure also 
provides for slowing the rate of system timer interrupts to prevent 
time interrupts from constantly occurring while a system is being 
monitored. 

Applicants respectfully submit that neither Figs. 2 or 3 disclose 
implementing a burst sampling algorithm for determining whether 
to process a group of data for network traffic data collection. Fig. 
2, as stated above, only illustrates initiating a system for 
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monitoring performance of various processors. Fig. 3 provides 
only a method of handling external interrupts for beginning the 
sampling of instructions on a set of multiprocessors. Blandy 
discloses a burst mask to set a number of instructions monitored 
over a set of intervals and does not relate this to network traffic 
monitoring nor does Hegde. 

(3) Blandy 2:64-66: The cited section states "accordingly, the present invention is 

directed to a system and method for monitoring system 
performance by sampling instructions in a burst mode, rather than 
once per interrupt." (emphasis added). Applicants respectfully 
submit that the cited section provides no disclosure of a burst 
sampling algorithm being used to determine whether to process a 
group of information for network traffic data collection. 

(4) Blandy 3:12-19: The cited section discusses burst sampling of executed instructions 

in a symmetric multiprocessing environment by giving each 
processor its own dynamic tree structure. Applicants respectfully 
submit that this section has no relation to the claim language. 

(5) Blandy 4:26-50: The cited section discusses Fig. 2, which is discussed above. For 

the reasons cited above, Applicants respectfully submit that this 
cited section contains no disclosure of the claim language. 

For these reasons cited above, Applicants respectfully submit that Blandy provides no disclosure 
of using a burst sampling algorithm to determine whether to process a group of information for 
network traffic data collection. Applicants further submit that the cited sections provide no 
disclosure of using a burst sampling algorithm to select any type of information, and instead 
relate only to configuring a system to utilize sampling of processor instructions. 

Selecting Based on Examination of Traffic Attribute Data (Blandy) 

The Final Office Action further cites Blandy against selecting a group of information 

based on an examination of traffic attribute data in the group of information for determining 

whether to process a group of information for network traffic data collection. The following 

sections of Blandy are cited for this proposition: 

(1) Fig. 2 (33-39): As discussed above, the cited elements relate only to configuring 
the burst sampling of processor instructions in a configurable 
multiprocessor system, by using a burst mask. Applicants 
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respectfully submit that the cited steps do not relate to an 
examination of traffic attribute data in order to select a group of 
information as claimed, since no information from the claimed 
group of information is used. 

(2) Fig. 3 (41-58): The cited steps include each step that is illustrated in Fig. 3 and 

which are discussed above. Again, at best the cited disclosure 
relates only to a burst sampling algorithm being configured in a 
symmetric multiprocessor environment and not to selecting a 
group of information based on examination of traffic attribute data 
in the group of information as claimed. 

(3) Blandy 4:30-6:26: These cited sections are an explanation of Figs. 2 and 3 discussed 

above. The Final Office Action submits that this explanation 
relates to "setting/allocating data according to time/count of traffic 
data." Applicants respectfully submit that this is not disclosed in 
the cited section. The burst sampling that is purported to be 
initiated by the disclosure is based on a burst mask that sets how 
many instructions will be monitored in an interval and a response 
to an external interrupt. Applicants submit that the burst mask and 
the external interrupt are not provided by the data being monitored 
and therefore there is no selection of a group of information based 
on an examination of the traffic attribute data in that group of 
information as claimed. 

For the above reasons, Applicants respectfully submit that Blandy fails to provide disclosure of a 
burst algorithm or selecting a group of information based on an examination of traffic attribute 
data in the group of information, both of which are used to determine whether to process the 
group of information for network traffic data collection. 

No Suggestion To Combine References 

The Final Office Action responds to Applicants previous discussion that there is no 
suggestion to combine the references by stating, "it would have been obvious to one having 
ordinary skill in the art at the time the invention was made to provide a burst sampling algorithm, 
as taught by Blandy in the system of Hegde, so that it would provide a performance system 
monitor system performance [sic] with minimal changes to the operating system and no changes 
to application code; also it would provides mechanism for monitoring system performance by 
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sampling in a burst mode, rather than once per interrupt." Final Office Action, pp. 19-20. As an 
initial matter, due to the wording chosen for the Final Office Action, Applicants are not certain 
what the Examiner believes is taught by the combination of the references (e.g., "a performance 
system monitor system performance"). Nonetheless, Applicants respond to the best of their 
understanding. 

Applicants respectfully submit that the quoted statement does not provide a suggestion to 
combine the references to achieve the claimed invention. The claimed invention is related to the 
field of network traffic data monitoring (as that term is defined in the present application). 
Neither Hegde nor Blandy is related to network traffic data monitoring. A person of ordinary 
skill in the art would not be motivated, based upon the disclosure in either reference, to combine 
Blandy's purported mechanism for monitoring processor instruction statistics in a set of 
symmetric multiprocessors with the flow-table router system of Hegde to achieve the claimed 
invention. Even were a person of ordinary skill in the art to consider the Blandy disclosure as 
relevant to the field of network data collectoin, given that the Hegde router must analyze every 
packet that passes through the router to make the disclosed flow forwarding decisions, there 
would be no motivation to combine such disclosure with any reference that suggests not 
analyzing every packet that passes through the router. Further, since Hegde provides no 
disclosure or discussion of sampling algorithms, one would not be motivated by alternate 
sampling methods to combine Hegde with any other reference disclosing such alternate sampling 
methods. 

No Reasonable Expectation of Success 

The Final Office Action also states "in response to Applicant's argument that one would 
not expect success from combining, the test for obviousness is not whether the features of a 
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secondary reference may be bodily incorporated into the structure of the primary reference; nor 
is it that the claimed invention must be expressly suggested in any one or all of the references." 
A requirement for obviousness is that there must be a reasonable expectation of success in the 
combination of the references. See MPEP 2143; MPEP 2143.03; In re Rouffet, 149 F.3d 1350, 
1355-56 (Fed. Cir. 1998). In Applicants' response to the Office Action dated September 21 , 
2005, Applicants established that there is no reasonable expectation of success in the combining 
of Hegde with Blandy. See Response to Non-Final Office Action, pp. 14-15. Applicants 
specifically incorporate that argument herein. In summary, Applicants submit that if a Hegde 
device does not analyze at least the source and destination of each received packet , then the 
Hegde device cannot effectively update flow tables. Therefore, there can be no expectation of 
success of a combination of Hegde with any disclosure suggesting anything but analysis of every 
packet arriving at a Hegde device. Sampling packets is contrary to the Hegde disclosure. 
Further, there is no indication within Hegde or Blandy that the use of Blandy' s interrupt driven 
system can function to sample network traffic data, nor has the Examiner presented any rationale 
for the functionality of such an interrupt driven system in sampling network traffic data. Burst 
sampling as described in the present application relates to sampling a set number of packets, 
while Blandy discloses setting a burst collection time period based on a number of interrupts. 

For all of the above reasons, Applicants respectfully submit that independent Claims 1 , 9, 
16 and 23, and all claims dependent thereon, are in condition for allowance. Applicants 
therefore respectfully request withdrawal of the final rejection and an indication of allowance of 
all claims in the present application. 
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CONCLUSION 

In view of the amendments and remarks set forth herein, the application and the claims 
therein are believed to be in condition for allowance without any further examination and a 
notice to that effect is solicited. Nonetheless, should any issues remain that might be subject to 
resolution through a telephonic interview, the Examiner is invited to telephone the undersigned 
at 512-439-5090. 



I hereby certify that this correspondence is being deposited with 
the United States Postal Service as First Class Mail in an envelope 
addressed to: Mail Stop AF, COMMISSIONER FOR PATENTS, 
R O. Box 1450, Alexandria, VA 22313-1450, on 
l>ec^O 2005. 




Attorney for Applicant(s) 



Respectfully submitted, 




Attorney for Applicants 
Reg. No. 44,702 
(512) 439-5080 [Phone] 
(512) 439-5099 [Fax] 
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